git: 454212b9718b - main - sctp: fix so_proto when peeling off a socket

The branch main has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=454212b9718b55b43781f81bef252658e20e0fd3

commit 454212b9718b55b43781f81bef252658e20e0fd3
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2026-02-25 12:55:54 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2026-02-25 12:55:54 +0000

    sctp: fix so_proto when peeling off a socket
    
    Reported by:            glebius
    Reviewed by:            rrs
    Fixes:                  d195b3783fa4 ("sctp: fix socket type created by sctp_peeloff()")
    Differential Revision:  https://reviews.freebsd.org/D55454
---
 sys/kern/uipc_socket.c      | 4 ++--
 sys/netinet/sctp_syscalls.c | 4 +++-
 sys/sys/socketvar.h         | 2 +-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index 8b5d1f504e80..f7c339784693 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -1316,7 +1316,7 @@ solisten_enqueue(struct socket *so, int connstatus)
  * XXXGL: reduce copy-paste with solisten_clone().
  */
 struct socket *
-sopeeloff(struct socket *head)
+sopeeloff(struct socket *head, struct protosw *so_proto)
 {
 	struct socket *so;
 
@@ -1336,7 +1336,7 @@ sopeeloff(struct socket *head)
 	so->so_linger = head->so_linger;
 	so->so_state = (head->so_state & SS_NBIO) | SS_ISCONNECTED;
 	so->so_fibnum = head->so_fibnum;
-	so->so_proto = head->so_proto;
+	so->so_proto = so_proto;
 	so->so_cred = crhold(head->so_cred);
 #ifdef MAC
 	mac_socket_newconn(head, so);
diff --git a/sys/netinet/sctp_syscalls.c b/sys/netinet/sctp_syscalls.c
index 80d1d58a7866..01f241d29637 100644
--- a/sys/netinet/sctp_syscalls.c
+++ b/sys/netinet/sctp_syscalls.c
@@ -75,6 +75,8 @@
 #include <security/mac/mac_framework.h>
 
 #include <netinet/sctp.h>
+#include <netinet/sctp_pcb.h>
+#include <netinet/sctp_var.h>
 #include <netinet/sctp_os_bsd.h>
 #include <netinet/sctp_peeloff.h>
 
@@ -171,7 +173,7 @@ sys_sctp_peeloff(struct thread *td, struct sctp_peeloff_args *uap)
 	td->td_retval[0] = fd;
 
 	CURVNET_SET(head->so_vnet);
-	so = sopeeloff(head);
+	so = sopeeloff(head, &sctp_stream_protosw);
 	if (so == NULL) {
 		error = ENOMEM;
 		goto noconnection;
diff --git a/sys/sys/socketvar.h b/sys/sys/socketvar.h
index 6512a2d69fd5..0417223680fe 100644
--- a/sys/sys/socketvar.h
+++ b/sys/sys/socketvar.h
@@ -525,7 +525,7 @@ struct socket *
 struct socket *
 	sonewconn(struct socket *head, int connstatus);
 struct socket *
-	sopeeloff(struct socket *);
+	sopeeloff(struct socket *, struct protosw *);
 int	sopoll_generic(struct socket *so, int events, struct thread *td);
 int	sokqfilter_generic(struct socket *so, struct knote *kn);
 int	soaio_queue_generic(struct socket *so, struct kaiocb *job);